4 ms·
The standard attack in this case is that someone could steal your cookies (if they are Js cookies) or execute instructions on gkoberger.github.io without your p
by jxcole 8y ago
The standard attack in this case is that someone could steal your cookies (if they are Js cookies) or execute instructions on gkoberger.github.io without your permission, since that is the context.
The way you would do this is create an answer to one of these questions on stack overflow that includes malicious javascript.
However, it's kind of unlikely there is much you can do with it. Sometimes a site will share cookies with subdomains, but this is not likely for github because you are allowed to publish arbitrary js there, so that would be a huge security hole.
- Uehreka 8y agoThis is why GitHub uses a separate domain (github.io as opposed to github.com) for user sites.
- floil 8y agoMoreover, github.io is in the public suffix list, so it is effectively a TLD (foo.github.io is a different site from bar.github.io; they can't become same origin by means of document.domain). The risk of eval() is giving control of the site data of foo.github.io to the author of a stackoverflow comment. The warning is part of the fun, though.
- _puk 8y agoGithub hasn't always used a seperate domain for user sites [0]. They do now to directly address the GP's concerns. http://homakov.blogspot.com/2013/03/hacking-github-with-webkit.html http://homakov.blogspot.com/2013/03/hacking-github-with-webk...